Read and share authentication credentials from OpenCode

[yan-ad]

Summary

Make Crabcode read and share authentication credentials from OpenCode so users can switch from OpenCode without re-entering provider credentials.

Motivation

Crabcode is intended to replace the Node-based OpenCode CLI and already reads OpenCode configuration files such as opencode.jsonc. However, authentication is currently stored separately at:

~/.local/state/crabcode/auth.json

OpenCode stores credentials at:

~/.local/share/opencode/auth.json

This requires users to authenticate again and creates duplicate credential stores.

Proposed solution

Adopt OpenCode's authentication file as Crabcode's canonical auth source:

• Read $XDG_DATA_HOME/opencode/auth.json
• Default to ~/.local/share/opencode/auth.json
• Preserve existing Crabcode credentials through a one-time migration or safe fallback
• Ensure login, logout, and credential updates use the canonical OpenCode path
• Preserve secure file permissions and test isolation

Acceptance criteria

• Existing OpenCode credentials are detected automatically
• Crabcode can authenticate using ~/.local/share/opencode/auth.json
• Existing Crabcode credentials are migrated or safely used as fallback
• OpenCode credentials are never overwritten unintentionally
• Login and logout operate on the selected canonical store
• XDG path behavior is covered by tests
• Authentication documentation is updated

[Blankeos]

Hi yan-ad, I appreciate opening the issue, since I definitely need time to decide on this. It's a great idea.

Crush (the Go coding agent) did this, and it kind of 'icked me because I genuinely thought Crush had openai/claude models included for free (lol I wish). Then later realized it was using my OpenCode/Codex/Claude tokens lol. So I felt like being explicit is better than clever here.

Also there's a mixed bunch of config files that I chose to read/not-read from opencode at the moment (my best effort is just documenting it). That's why I want to think about this a bit more...

My options

• Never cross-merge.
  • 🔴 more explicit, higher friction
  • 🟢 more freedom with deviating away from opencode
• Always cross-merge.
  • 🟢 less explicit, lower friction
  • 🔴 less freedom with deviating away from opencode
• Partially cross-merge (w/ docs). this is the current approach
  • documented here: https://crabcode.rs/config#file-layout (I'll improve it)
  • 🟢 less explicit, still low friction
  • 🟢 more freedom with deviating away from opencode
• Partially cross-merge (but user-controlled).
  • With defaults I prefer...
  • We could wrap it in a config or something. mergeOpenCodeAuth: true or something. And I can also see a case for other config paths... So it might be better to make a...

   "opencodeCrossMerge": {
        "auth": true,
        "agents": true // Note, I made them not cross-merge at the moment as well
   },

Anyway I'll keep this issue open till I think about it. For now it's not a blocker anyway.